Suspicious Activity Reports (SARs) and the NCA

A Suspicious Activity Report — a SAR — is the formal mechanism by which businesses tell the authorities they have spotted something that may be money laundering or terrorist financing. SARs are the lifeblood of the UK's financial-intelligence system: they are how private-sector suspicion reaches law enforcement.

1What a SAR is

A SAR is a disclosure to the National Crime Agency (NCA) about known or suspected money laundering — under Part 7 of the Proceeds of Crime Act 2002 (POCA) — or terrorist financing under Part 3 of the Terrorism Act 2000. The NCA's UK Financial Intelligence Unit (UKFIU) receives, analyses and distributes SARs to law enforcement.

SARs are submitted electronically through the NCA's SAR portal. The information feeds investigations, identifies victims and assets, and builds the intelligence picture on serious and organised crime.

2Who must submit one — and the two routes in

Within a regulated firm, employees report internally to the nominated officer (the MLRO), who decides whether to make a SAR to the NCA. There are two distinct reasons to file:

• A required disclosure — you have knowledge or suspicion of money laundering and are under a legal duty to report (failure to do so in the regulated sector is itself an offence under POCA section 330).
• A Defence Against Money Laundering (DAML) — you are about to do something with property you suspect is criminal (process a payment, complete a transaction), and you need legal protection before you act.

3How DAML consent works

This is the part most often misunderstood, and the numbers matter, so they are worth stating precisely from the legislation.

If you want to carry out an act that might make you complicit in one of the principal money-laundering offences, you can make an authorised disclosure and seek appropriate consent. Under POCA section 335:

• The notice period is seven working days, beginning with the first working day after you make the disclosure.
• If, before the end of that period, you do not receive notice that consent is refused, you are treated as having consent and may proceed.

If consent is refused within the notice period, a waiting period kicks in. Under POCA section 336:

• The moratorium period is 31 days, starting with the day the refusal notice is given.
• During the moratorium you must not carry out the act. Once the 31 days expire (absent further legal steps), you may proceed.

Since the Criminal Finances Act 2017, the moratorium period can be extended by a court, in increments, up to a cumulative maximum — giving law enforcement time to act on high-value or complex matters. The default position, though, is the 7-working-day notice period followed, if consent is refused, by the 31-day moratorium.

4The tipping-off trap

Filing a SAR creates a second obligation: do not tip off. As covered in our money laundering guide, POCA section 333A makes it an offence to disclose, in the course of regulated-sector business, information likely to prejudice a money-laundering investigation. In practice this means you cannot tell a customer "we've reported you," and you must handle the relationship carefully while a SAR is in train. Balancing the duty to report against the duty not to tip off is one of the harder day-to-day judgements in compliance.

5Quality over quantity

The NCA has repeatedly emphasised that the usefulness of a SAR depends on its quality — a clear statement of what is suspicious, about whom, and why, with the relevant identifiers. A vague, defensive report ("filing just in case") helps no one and can bury genuine intelligence. Good SARs are specific, well-evidenced and timely.

6Where Probitas fits

A SAR turns on suspicion, and suspicion is better-founded when you can see the evidence. Probitas assembles the public-record picture on an entity — ownership, sanctions and PEP exposure, filing history, adverse media — with every claim sourced, so that a decision to report (or not) rests on documented facts rather than a hunch. The decision itself, and the SAR, remain yours: Probitas is not a reporting tool and does not file SARs.